Anonymous offers support to Tunisian protestors (Update 2)

In this latest update, The Tech Herald will address the newest developments in Tunisia. The original story will start on page three. The first update can be found on page two.

Mohamed Bouazizi, the young man who immolated himself in protest, sparking the civil unrest in Tunisia, has died. This tragic news is confirmed by both local sources in Tunisia and international media. Last week, there was confusion as to whether or not he had succumbed to his injuries. At the time we reported his survival, Tunisians on Twitter and Facebook were debating his status. Confirmation of his death came 24 hours after our last update.

There is more bad news. Wire reports state at least 23 people have died this weekend as the Tunisians continued their protests. The violence was centered in the central part of the country, in the cities of Kessarine, Tala and Regueb. The number of deaths is expected to rise, due largely to the critical injuries sustained by those protesting.

The Tunisian government has been under pressure to stop using live ammunition against protestors. The failure to do so has led to more bloodshed and countless injuries. Officially, the Tunisian government has reported the number of dead at 14, and said that the use of live rounds is an “act of legitimate self-defense”.

On Friday, Reporters Without Borders said that several bloggers and critics of the Tunisian government have been arrested.

Hamadi Kaloutcha, a blogger and activist, was arrested at his home. While arresting him, police confiscated his computer equipment. Sleh Edine Kchouk, a student activist, was also arrested last week and had his computer seized as well. They have not been seen since.

Hamada Ben Aoun, a rapper who recently released two songs on his Facebook account criticizing the Tunisian regime and its social policies, was arrested around the same time as the others. According to Reuters, he was released on Monday.

Slim Amamou, one of the more visible Tunisian bloggers online, has also dropped off the grid. There has been no word of his status since Thursday. In their story, Reporters Without Borders said that sources told them he was being held at the Ministry of Interior. News of his disappearance shocks us here at The Tech Herald, because his work on the Tunisian government’s involvement in password hijacking was a big help in our report on the topic.

Azyz Amamy, who had covered the Tunisian protests from the beginning, has also gone missing, presumably arrested. His Blogger account and Facebook account have both been deactivated. There is no word as to his status.

“These arrests, intended to intimidate Tunisian Internet-users and their international backers, are likely to prove counter-productive, by stoking up tension. Arresting several bloggers is not the way to get images of demonstrations deleted from the web or for cyber-attacks to be halted”, Reporters Without Borders said in a statement.

“Stepping up the repression is absolutely not a solution to the crisis engulfing Tunisia today”.

When it comes to Anonymous’ actions against the Tunisian government there have been a few interesting developments. Operation: Tunisia is still growing, as the number of people taking part has nearly doubled since our last update.

The Distributed Denial of Service (DDoS) attacks continue, but they hit a bit of a snag when the Tunisian government null-routed foreign Internet traffic to their primary TLD, .gov.tn. In response to the traffic blocks, Anonymous shifted to other targets including TunisiaOnline.com.

When it was discovered that the Tunisian Internet Agency (ATI) was injecting JavaScript into web forms, using it to harvest usernames and passwords, Anonymous reacted by releasing a browser add-on that strips the added JavaScript code. The Greasemonkey script allows Tunisian surfers to access Blogger, Facebook, Gmail, Yahoo, and Twitter without exposing their login details. Our coverage on ATI’s actions is here.

While the JavaScript filter is a step in the right direction, there are other ways that ATI can track Internet users. Due to this, Anonymous has added to their bag of tricks. While the DDoS attacks and website defacements are still the choice for some of those participating in Operation: Tunisia, others are championing the cause of protection.

In an effort to support a restriction-free Internet in Tunisia, members of Anonymous have gathered to promote links to what they’re calling a care package for Tunisian protestors. In it, they have included how-to guides for a number of things including homemade gas masks. In addition, they are circulating information on TOR usage, links to Tunisian proxies, instructions for LiveCD usage, and a book titled Bypassing Internet Censorship.

Since we last visited the story of Anonymous helping protesters in Tunisia, there have been a few clarifications and developments shared with us. This update will bring anyone following the story up to speed.

On IRC, there have been several users from Tunisia sharing information and details regarding life in their country since the protests began. Their stories support the details coming out on Twitter and Facebook, painting a picture of a full-scale revolt.

The Tech Herald has learned that the reported death of the man who immolated himself, Mohamed Bouazizi, is untrue. Tragically, he shares his name with another protester who did die recently. According to reports, there have been dozens of injuries and at least four deaths.

Speaking to one Tunisian, we’ve learned that the police have been brutal when dealing with protestors, using live ammunition and other means of crowd control. Based on reports from Al Jazeera, who has been reporting from the ground, and those we’ve spoken to on IRC, there are several cases where police have beaten protesters outright.

There are questionable controls in some areas we’re told, such as access to religious leaders, which has been denied. One user explained how local mosques are only available during certain times of the day now.

“In the mosques we have not the right to learn our religion, we do the prayer, and they close the mosques,” a Tunisian explained to us on IRC.

“We have five prayer sessions a day. We go to the mosque, do it, and then they close the mosque until the next prayer. In the past there is Imam (religion man) who [teaches] people the Quran, now we have nothing.”

We’re no religious experts, but we’re not sure what is gained by denying someone access to a spiritual leader. Two other users we spoke to from Tunisia confirmed these reports, adding that some Muslim men with beards are targeted for harassment by local police and officials.

Investigations into these claims have resulted in the discovery of JavaScript attacks on anyone using Tunisian Internet services. We’re digging into the JavaScript code with the help of some experts, and will report those findings in a separate update.

In the meantime, the existence of questionable JavaScript code led Anonymous to offer Tunisian users help via Userscripts.org, with a browser add-on that strips the added JavaScript code.

In addition to helping Tunisians move past Internet filters and surf anonymously. Operation: Tunisia has pushed forward by attacking one of the DNS servers used by the Tunisian government. The result is a near blackout for many of the government’s sites. However, this new DDoS target is resulting in some fallout, as media sites and other non related sites, such as banking sites, are caught in the mix.

As predicted, Tunisian President Ben Ali's wife, Leila Ben Ali, and her extended family - the Trabelsis - are now official targets of Operation: Tunisia. Websites linked to businesses owned by the extended presidential family have been taken offline.

In addition to the sites listed yesterday, Anonymous has also taken down sicad.gov.tn, indrustrie.gov.tn, commerce.gov.tn, and douane.gov.tn.

In agreement with those protesting on the ground, who are bleeding and in some cases dying for speaking out against the Tunisian government, Anonymous has launched another Distributed Denial of Service attack against an African nation.

It started with a man setting himself on fire. In early December, after having the entire stock for his business confiscated, which consisted of fruit and vegetables sold from his stall in the town of Sidi Bouzid, Tunisia, a depressed and frustrated Mohamed Bouazizi immolated himself.

His actions shocked a nation. Soon after, protests and riots swept the country, resulting in injury, scores of arrests, and ending the lives of four people. The protests and riots in Tunisia have been compared to similar acts seen just before the fall of the Romanian dictator, Nicolae Ceausescu in 1989 by The Guardian.

President Zine El Abidine Ben Ali, who has ruled since the late 80’s, portrays Tunisia as the golden child of the Arab world. But the growing poverty, lack of jobs, and general spite from his people paint a different picture. Moreover, Ben Ali’s government was slammed by diplomatic cables released by WikiLeaks that call Tunisia as a police state.

One cable, which relays information from a redacted source and a book they were writing, compared the corruption in Tunisia to a “cancer that is spreading spurred on by the corrupt practices of President Ben Ali and his extended family.”

Another cable, classified as secret by Ambassador Robert F. Godec in 2008, reported that in Tunisia the government takes a stance of “what’s yours is mine”.

“...Beyond the stories of the First Family's shady dealings, Tunisians report encountering low-level corruption as well in interactions with the police, customs, and a variety of government ministries… With those at the top believed to be the worst offenders, and likely to remain in power, there are no checks in the system.”

In response to the WikiLeaks releases, Ben Ali’s government blocked WikiLeaks, a Tunisian WikiLeaks mirror, and several media outlets reporting on the cables.

Shortly after the reigns were tightened on the Web in Tunisia, members of Anonymous gathered on IRC and discussed a new target. In just under 9 hours, more than 200 Anons singled out various Tunisian government sites and took them offline.

“The Tunisian government wants to control the present with falsehoods and misinformation in order to impose the future by keeping the truth hidden from its citizens. We will not remain silent while this happens. Anonymous has heard the claim for freedom of the Tunisian people. Anonymous is willing to help the Tunisian people in this fight against oppression. It will be done,” said a statement from Anonymous to the press.

“This is a warning to the Tunisian government… It's on the hands of the Tunisian government to stop this situation. Free the net, and attacks will cease, keep on that attitude and this will just be the beginning.”

It is understood that this action, dubbed Operation: Tunisia, is an umbrella operation to the widely-known Operation: Payback. Also of note, most of those taking part are from Tunisia itself, and are launching DDoS attacks in support of those on the ground protesting.

Referencing the DDoS attacks and the Tunisians, supporters of Ben Ali called them “a dirty war led by hackers in collaboration with a group of traitors”.

In terms of scope, while the main point of the Anonymous press release was censorship, those taking part in this operation are clearly against all of the actions taken by the Tunisian government, including the reported corruption.

At this point, several Tunisian government domains have been taken down completely, or have been severely crippled by the DDoS attacks. Included in the list of targets are pm.gov.tn, rcd.tn, benali.tn, carthage.tn, bvmt.com.tn, and ministeres.tn.

In addition to being knocked offline, the Prime Minister’s domain (pm.gov.tn) was defaced with a message from Anonymous including the infamous Operation: Payback logo. [Image 1] [Image 2] [Image 3]

Another site with the same defacement, marchespublics.gov.tn, can be seen here.

Given that Ben Ali's extended family is often found at the center of Tunisian corruption, his wife, Leila Ben Ali, and her extended family - the Trabelsis - are being discussed as potential targets. If this happens, then websites that are linked to businesses owned by them will suffer the same fate as the government portals.